@bitpay-labs/bitcore-wallet-service 11.10.3 → 11.10.5

package/.mocharc.yml

@@ -0,0 +1,2 @@
+enable-source-maps: true
+exit: true

package/.nycrc.yml

@@ -0,0 +1,13 @@
+include: [
+   ts_build/src,
+   src
+]
+reporter: [
+   html,
+   text-summary
+]
+check-coverage: true
+statements: 60
+branches: 50
+functions: 60
+lines: 70

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.3",
+  "version": "11.10.5",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -24,9 +24,7 @@
   "scripts": {
     "start": "npm run clean && npm run build && ./start.sh",
     "stop": "./stop.sh",
-    "coverage": "npm run compile && nyc mocha 'ts_build/test/**/*.test.js'",
-    "test": "npm run compile && mocha --exit 'ts_build/test/**/*.test.js'",
-    "test:ci": "BWS_LOG_LEVEL=none npm run test",
+    "test": "npm run compile && nyc mocha 'ts_build/test/**/*.test.js'",
     "build": "tsc && npm run cp:templates",
     "build:prod": "tsc -p tsconfig.prod.json && npm run cp:templates",
     "build:docker": "docker build -t bitpay/bitcore-wallet-service:latest -f ./Dockerfile ../..",
@@ -43,9 +41,9 @@
     "cp:templates": "cp -r ./templates ./ts_build/templates"
   },
   "dependencies": {
-    "@bitpay-labs/bitcore-logging": "^11.10.3",
-    "@bitpay-labs/bitcore-tss": "^11.10.3",
-    "@bitpay-labs/crypto-wallet-core": "^11.10.3",
+    "@bitpay-labs/bitcore-logging": "^11.10.4",
+    "@bitpay-labs/bitcore-tss": "^11.10.4",
+    "@bitpay-labs/crypto-wallet-core": "^11.10.4",
     "@sendgrid/mail": "6.5.4",
     "abi-decoder": "2.4.0",
     "async": "0.9.2",
@@ -86,27 +84,10 @@
     "@types/request": "^2.48.1",
     "chai": "^5.2.0",
     "memdown": "^1.0.0",
-    "mocha": "^5.2.0",
-    "nyc": "^17.1.0",
     "sinon": "^7.1.1",
     "supertest": "*",
     "typescript": "^5.7.3"
   },
-  "nyc": {
-    "include": [
-      "ts_build/src",
-      "src"
-    ],
-    "reporter": [
-      "html",
-      "text-summary"
-    ],
-    "check-coverage": true,
-    "lines": 60,
-    "functions": 60,
-    "branches": 60,
-    "statements": 60
-  },
   "bitcoreNode": "./bitcorenode",
   "contributors": [
     {
@@ -126,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "70298eedd1e458b23139e275125a07c577219bac"
+  "gitHead": "78b95920daa1de2feaa6744d009ad033f520fc3e"
 }

package/src/externalservices/ramp.ts

@@ -112,14 +112,13 @@ export class RampService {
     const webRequiredParams = [
       'selectedCountryCode',
     ];
-    const appRequiredParams = [
+    let appRequiredParams = [
       'enabledFlows',
       'defaultFlow',
       'selectedCountryCode',
-      'defaultAsset',
     ];
-    const extraRequiredParams = req.body.flow && req.body.flow === 'sell' ? ['offrampAsset'] : ['finalUrl', 'userAddress', 'swapAmount', 'swapAsset'];
-    appRequiredParams.concat(extraRequiredParams);
+    const extraRequiredParams = req.body.flow && req.body.flow === 'sell' ? [] : ['finalUrl', 'userAddress'];
+    appRequiredParams = appRequiredParams.concat(extraRequiredParams);
 
     const requiredParams = req.body.context === 'web' ? webRequiredParams : appRequiredParams;
     const keys = this.rampGetKeys(req);
@@ -138,21 +137,42 @@ export class RampService {
     qs.push('selectedCountryCode=' + encodeURIComponent(req.body.selectedCountryCode));
     if (req.body.finalUrl) qs.push('finalUrl=' + encodeURIComponent(req.body.finalUrl));
     if (req.body.userAddress) qs.push('userAddress=' + encodeURIComponent(req.body.userAddress));
-    if (req.body.swapAsset) qs.push('swapAsset=' + encodeURIComponent(req.body.swapAsset));
-    if (req.body.offrampAsset) qs.push('offrampAsset=' + encodeURIComponent(req.body.offrampAsset));
     if (req.body.enabledFlows) qs.push('enabledFlows=' + encodeURIComponent(req.body.enabledFlows));
     if (req.body.defaultFlow) qs.push('defaultFlow=' + encodeURIComponent(req.body.defaultFlow));
     if (req.body.hostLogoUrl) qs.push('hostLogoUrl=' + encodeURIComponent(req.body.hostLogoUrl));
     if (req.body.hostAppName) qs.push('hostAppName=' + encodeURIComponent(req.body.hostAppName));
-    if (req.body.swapAmount) qs.push('swapAmount=' + encodeURIComponent(req.body.swapAmount));
-    if (req.body.fiatValue) qs.push('fiatValue=' + encodeURIComponent(req.body.fiatValue));
-    if (req.body.fiatCurrency) qs.push('fiatCurrency=' + encodeURIComponent(req.body.fiatCurrency));
-    if (req.body.defaultAsset) qs.push('defaultAsset=' + encodeURIComponent(req.body.defaultAsset));
     if (req.body.userEmailAddress) qs.push('userEmailAddress=' + encodeURIComponent(req.body.userEmailAddress));
     if (req.body.useSendCryptoCallback) qs.push('useSendCryptoCallback=' + encodeURIComponent(req.body.useSendCryptoCallback));
     if (req.body.paymentMethodType) qs.push('paymentMethodType=' + encodeURIComponent(req.body.paymentMethodType));
     if (req.body.hideExitButton) qs.push('hideExitButton=' + encodeURIComponent(req.body.hideExitButton));
-    if (req.body.useSendCryptoCallbackVersion) qs.push('useSendCryptoCallbackVersion=' + encodeURIComponent(req.body.useSendCryptoCallbackVersion));
+
+    // Ramp deprecated the legacy per-flow search params in favor of a unified format.
+    // Ref: https://docs.rampnetwork.com/search-params-migration
+    // Older app versions still send the legacy fields, so we translate them into the new
+    // unified params here to keep those requests working going forward.
+    // `flow === 'sell'` => OFFRAMP; otherwise => ONRAMP.
+    // If a newer client already sends the new params, those take precedence.
+    const isOfframp = req.body.flow === 'sell';
+
+    // enabledCryptoAssets <- swapAsset (onramp) / offrampAsset (offramp)
+    const enabledCryptoAssets = req.body.enabledCryptoAssets ?? (isOfframp ? req.body.offrampAsset : req.body.swapAsset);
+    if (enabledCryptoAssets) qs.push('enabledCryptoAssets=' + encodeURIComponent(enabledCryptoAssets));
+
+    // inAsset (incoming, paid by the user) <- fiatCurrency (onramp) / defaultAsset (offramp)
+    const inAsset = req.body.inAsset ?? (isOfframp ? req.body.defaultAsset : req.body.fiatCurrency);
+    if (inAsset) qs.push('inAsset=' + encodeURIComponent(inAsset));
+
+    // outAsset (outgoing, received by the user) <- defaultAsset (onramp) / fiatCurrency (offramp)
+    const outAsset = req.body.outAsset ?? (isOfframp ? req.body.fiatCurrency : req.body.defaultAsset);
+    if (outAsset) qs.push('outAsset=' + encodeURIComponent(outAsset));
+
+    // inAssetValue (units, no decimals) <- fiatValue (onramp) / swapAmount (offramp)
+    const inAssetValue = req.body.inAssetValue ?? (isOfframp ? req.body.swapAmount : req.body.fiatValue);
+    if (inAssetValue) qs.push('inAssetValue=' + encodeURIComponent(inAssetValue));
+
+    // outAssetValue (units, no decimals) <- swapAmount (onramp) / fiatValue (offramp)
+    const outAssetValue = req.body.outAssetValue ?? (isOfframp ? req.body.fiatValue : req.body.swapAmount);
+    if (outAssetValue) qs.push('outAssetValue=' + encodeURIComponent(outAssetValue));
 
     const queryString = qs.join('&');
 

package/src/lib/expressapp.ts

@@ -126,6 +126,7 @@ export class ExpressApp {
 
     registerMoralisRoutes(router, {
       getServer,
+      getServerWithAuth,
       returnError
     });
 

package/src/lib/routes/moralis.ts

@@ -6,6 +6,7 @@ import type { WalletService } from '../server';
 
 interface RouteContext {
   getServer: Types.GetServerFn;
+  getServerWithAuth: Types.GetServerWithAuthFn;
   returnError: Types.ReturnErrorFn;
 }
 
@@ -33,6 +34,21 @@ function respondWithPublicServer(req, res, context: RouteContext, handler: Route
     });
 }
 
+function walletAuthOrPublic(context: RouteContext) {
+  return function(req, res, next) {
+    if (!req.header('x-identity')) {
+      // Not from wallet
+      return next();
+    }
+    return context.getServerWithAuth(req, res, _server => {
+      if (!req.header('origin')) {
+        req.headers['origin'] = config.moralis?.whitelist?.[0];
+      }
+      return next();
+    });
+  };
+}
+
 export function registerMoralisRoutes(router: express.Router, context: RouteContext) {
   const moralisCorsOptions = {
     origin: (origin, cb) => {
@@ -45,45 +61,57 @@ export function registerMoralisRoutes(router: express.Router, context: RouteCont
     }
   };
 
-  router.post('/v1/moralis/getWalletTokenBalances', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getWalletTokenBalances', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetWalletTokenBalances(req);
     });
   });
 
-  router.post('/v1/moralis/moralisGetTokenAllowance', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/moralisGetTokenAllowance', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetTokenAllowance(req);
     });
   });
 
-  router.post('/v1/moralis/moralisGetNativeBalance', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/moralisGetNativeBalance', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetNativeBalance(req);
     });
   });
 
-  router.post('/v1/moralis/GetTokenPrice', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/GetTokenPrice', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetTokenPrice(req);
     });
   });
 
-  router.post('/v1/moralis/getMultipleERC20TokenPrices', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getMultipleERC20TokenPrices', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetMultipleERC20TokenPrices(req);
     });
   });
 
-  router.post('/v1/moralis/getERC20TokenBalancesWithPricesByWallet', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getERC20TokenBalancesWithPricesByWallet', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetERC20TokenBalancesWithPricesByWallet(req);
     });
   });
 
-  router.post('/v1/moralis/getSolWalletPortfolio', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getSolWalletPortfolio', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetSolWalletPortfolio(req);
     });
   });
+
+  router.post('/v1/moralis/getTransactionVerbose', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
+    respondWithPublicServer(req, res, context, server => {
+      return server.moralisGetTransactionVerbose(req);
+    });
+  });
+
+  router.post('/v1/moralis/getMultipleSolTokenPrices', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
+    respondWithPublicServer(req, res, context, server => {
+      return server.moralisGetMultipleSolTokenPrices(req);
+    });
+  });
 }

package/src/lib/routes/services.ts

@@ -232,7 +232,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/banxa/getOrder', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.banxa.banxaGetOrder(req);
     });
   });
@@ -274,7 +274,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/moonpay/transactionDetails', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.moonpay.moonpayGetTransactionDetails(req);
     });
   });
@@ -292,7 +292,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/moonpay/accountDetails', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.moonpay.moonpayGetAccountDetails(req);
     });
   });
@@ -364,7 +364,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/sardine/ordersDetails', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.sardine.sardineGetOrdersDetails(req);
     });
   });
@@ -431,7 +431,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/thorswap/getSwapTx', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.thorswap.thorswapGetSwapTx(req);
     });
   });
@@ -467,7 +467,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/transak/orderDetails', cors(transakCorsOptions), (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.transak.transakGetOrderDetails(req);
     });
   });
@@ -509,13 +509,13 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/changelly/getTransactions', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.changelly.changellyGetTransactions(req);
     });
   });
 
   router.post('/v1/service/changelly/getStatus', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.changelly.changellyGetStatus(req);
     });
   });

package/src/lib/server.ts

@@ -5612,6 +5612,55 @@ export class WalletService implements IWalletService {
     });
   }
 
+  moralisGetTransactionVerbose(req): Promise<any> {
+    return new Promise(async (resolve, reject) => {
+      try {
+        const response = await Moralis.EvmApi.transaction.getTransactionVerbose({
+          transactionHash: req.body.transactionHash,
+          chain: req.body.chain,
+        });
+
+        return resolve(response?.raw ?? response);
+      } catch (err) {
+        reject(err);
+      }
+    });
+  }
+
+  moralisGetMultipleSolTokenPrices(req): Promise<any> {
+    return new Promise((resolve, reject) => {
+      if (!config.moralis) return reject(new Error('Moralis missing credentials'));
+      if (!checkRequired(req.body, ['addresses']) || !Array.isArray(req.body.addresses)) {
+        return reject(new ClientError('moralisGetMultipleSolTokenPrices request missing arguments'));
+      }
+
+      const network = req.body.network === 'devnet' ? 'devnet' : 'mainnet';
+      const headers = {
+        'Accept': 'application/json',
+        'Content-Type': 'application/json',
+        'X-Api-Key': config.moralis.apiKey,
+      };
+
+      const URL: string = `https://solana-gateway.moralis.io/token/${network}/prices`;
+
+      this.request.post(
+        URL,
+        {
+          headers,
+          body: { addresses: req.body.addresses },
+          json: true
+        },
+        (err, data) => {
+          if (err) {
+            return reject(err.body ?? err);
+          } else {
+            return resolve(data.body ?? data);
+          }
+        }
+      );
+    });
+  }
+
   moralisGetSolWalletPortfolio(req): Promise<any> {
     return new Promise(async (resolve, reject) => {
       let network;

package/test/expressapp.test.ts

@@ -610,6 +610,89 @@ describe('ExpressApp', function() {
         });
       });
 
+      describe('Moralis routes (wallet-authenticated or public)', function() {
+        const whitelistedOrigin = 'https://whitelisted-dapp.example';
+        let originalMoralisConfig;
+        beforeEach(function() {
+          originalMoralisConfig = config.moralis;
+          config.moralis = { whitelist: [whitelistedOrigin] };
+        });
+        afterEach(function() {
+          config.moralis = originalMoralisConfig;
+        });
+
+        it('/v1/moralis/getMultipleERC20TokenPrices should work without auth headers (public/dApp)', function(done) {
+          const server = {
+            moralisGetMultipleERC20TokenPrices: sinon.stub().resolves([{ tokenAddress: '0xaaa', usdPrice: 1 }]),
+          };
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns(server);
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/moralis/getMultipleERC20TokenPrices',
+              method: 'post',
+              json: { chain: '0x1', tokens: [{ tokenAddress: '0xaaa' }] },
+              headers: {
+                origin: whitelistedOrigin
+              }
+            };
+            request(requestOptions, function(err, res, body) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              body[0].tokenAddress.should.equal('0xaaa');
+              done();
+            });
+          });
+        });
+
+        it('/v1/moralis/getMultipleERC20TokenPrices should work with valid wallet auth headers', function(done) {
+          const server = {
+            moralisGetMultipleERC20TokenPrices: sinon.stub().resolves([{ tokenAddress: '0xaaa', usdPrice: 1 }]),
+          };
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns(server);
+          sandbox.stub(WalletService, 'getInstanceWithAuth').callsArgWith(1, null, server);
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/moralis/getMultipleERC20TokenPrices',
+              method: 'post',
+              json: { chain: '0x1', tokens: [{ tokenAddress: '0xaaa' }] },
+              headers: {
+                'x-identity': 'identity',
+                'x-signature': 'signature'
+              }
+            };
+            request(requestOptions, function(err, res, body) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              body[0].tokenAddress.should.equal('0xaaa');
+              done();
+            });
+          });
+        });
+
+        it('/v1/moralis/getMultipleERC20TokenPrices should fail with invalid wallet auth headers', function(done) {
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstanceWithAuth').callsArgWith(1, new ClientError('NOT_AUTHORIZED', 'Not authorized'));
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/moralis/getMultipleERC20TokenPrices',
+              method: 'post',
+              json: { chain: '0x1', tokens: [{ tokenAddress: '0xaaa' }] },
+              headers: {
+                'x-identity': 'identity',
+                'x-signature': 'bad-signature'
+              }
+            };
+            request(requestOptions, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(401);
+              done();
+            });
+          });
+        });
+      });
+
       describe('Token allowance', function() {
         it('/v1/token/allowance', function(done) {
           const server = {